Currently, when hanging a hidden chain which is also called a black chain, a hacker always configures an attribute of a Hypertext Markup Language (HTML) tag as display: none, by using many modes. For example, the hacker may configure in the HTML, configure in a Cascading Style Sheet (CSS) file via a CSS selector, or configure property settings of a web page node via JavaScript which is a programming language.
When hanging the hidden chain, the hacker modifies page content of a normal website. Hidden links pointing to other websites are added in a normal web page, and thus the number of external links of a target website is improved. The external link is a link pointing to a Uniform/Universal Resource Locator (URL) under a nonlocal domain name. The hung hidden chain is hidden content of the web page. Traditional detection modes are as follows.
In a static detection mode, the HTML, CSS and JavaScript commonly used by the hacker are collected, general text string characteristics are extracted, and the general text string characteristics are used to detect the hidden chain in the web page.
In a dynamic detection mode, JavaScript codes of the web page are executed by using an open source JavaScript engine, if it is found that executed codes has a function of hiding external links, it is determined that the page is hung with the hidden chain.